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Abstract 

We study the mapping which occurs when a single qubit in an arbitrary 
state interacts with another qubit in a given, fixed state resulting in some 
unitary transformation on the two qubit system which, in effect, makes two 
copies of the first qubit. The general problem of the quality of the resulting 
copies is discussed using a special representation, a generalization of the usual 
Schmidt decomposition, of an arbitrary two-dimensional subspace of a tensor 
product of two 2-dimensional Hilbert spaces. We exhibit quantum circuits 
which can reproduce the results of any two qubit copying machine of this 
type. A simple stochastic generalization (using a "classical" random signal) 
of the copying machine is also considered. These copying machines provide 
simple embodiments of previously proposed optimal eavesdropping schemes 
for the BB84 and B92 quantum cryptography protocols. 

I. INTRODUCTION 

Recent advances in quantum computation, and proposals for quantum cryptographic 
schemes, have led to a renewed interest in quantum information theory: how information 
is stored, processed, corrupted, and preserved from corruption in situations where quantum 
effects play an essential role. While classical information theory provides a starting point for 
a quantum theory of information, it is clear that classical ideas are not sufficient, but what 
should replace them is at present far less clear. 

As in any area of theoretical physics, two very different approaches are possible, as well 
as a broad continuum in between: one can search for very general results applicable to any 
quantum system, or one can work out specific models and simple examples. The present 
paper belongs to the second category: we are interested in what happens when two qubits, the 
simplest conceivable carriers of quantum information, interact with each other. Qubits a and 
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b — think of them as spins of two particles of spin one half — correspond to two-dimensional 
Hilbert spaces A and B. We suppose that they interact ("scatter") during a finite time 
interval, which results in a unitary transformation on the tensor product space A £g> B, after 
which they separate from each other and can be subjected to various measurements. 

So far as we know, no one has worked out a complete characterization (whatever that 
might be) of the things that can happen during such a unitary transformation on two qubits. 
The present paper represents only one step along the way towards addressing this general 
problem. We ask, and answer, the following question: Suppose the b qubit is initially in 
some arbitrary but fixed state \b), and the unitary transformation U is is also arbitrary but 
fixed. How does what emerges from the interaction of the two qubits depend upon the initial 
state of the a qubit? In particular, what might one learn by carrying out measurements on 
the a and b qubits once their interaction is over? 

A helpful way to view this question is in terms of quantum copying: the two qubits 
which emerge can in some sense be thought of as "copies" of the a qubit made by a "copying 
machine" constituted by the fixed b qubit together with the fixed unitary transformation. 
An essential aspect of the quantum copying problem is that the quantum state to be copied 
is (initially) unknown to the operator of the copying machine, who thus has to follow a fixed 
protocol, corresponding in our case to the fixed \b) and U. It then follows from the no-cloning 
theorem Q that no copying machine can make perfect copies of all incoming states, if they 
are not all orthogonal to each other. 

In a previous paper we discussed in very general terms the problem of producing 
two optimal copies of a single qubit, where optimality is defined relative to a particular 
"distinguishability" measure of copy quality. The present article discusses the interaction 
of two qubits as a two-qubit copying machine which, although less flexible than one which 
employs a third "ancillary" qubit, still satisfies the optimality criteria of 0, and we show 
that some additional flexibility can be achieved using a stochastic version of the two-qubit 
copier. However, this two qubit copier cannot serve as a "universal" copier in the sense 
defined in [|[, for reasons pointed out in Sec. Ill of that paper. (As the precise definition 
of optimality is a bit lengthy, and is not needed to understand the present paper, we refer 
the reader to [@] for the details, and for additional comments on how our work is related to 
other literature on quantum copying.) 

Making an approximate copy for himself while leaving another reasonably good copy 
behind is one way to state the problem faced by an eavesdropper trying to extract information 
from a quantum channel without producing the sort of noise which will alert the legitimate 
users of the channel to his presence. Various optimal eavesdropping strategies have been 
proposed for two quantum cryptographic protocols, BB84 [|J and B92 |J. In the case of 
BB84, the previous proposal required the use of three qubits (two in addition to the 
one carrying the original signal); we show that a two qubit copier suffices. In the case of 
B92 it has been argued previously though not conclusively proved, that two qubit 

eavesdropping can produce optimal results. Our contribution is to show that this can be 
done using an even simpler, and presumably cheaper, quantum circuit. 

The interaction of two qubits also provides a simple example of a "decoherence" process 
in which quantum information, thought of as present initially in the a qubit, is (partially) lost 
through interaction with the "environment", in this case the b qubit. While such a simple 
environment does not allow one to model the most general decoherence process possible for a 
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single qubit, it is nonetheless worth exploring precisely what it does allow, a question which 
is answered in the present paper. 

The basic strategy which we employ for studying the problem, Sec. ||, is to note that a 
unitary operator U on the tensor product A®B maps the two-dimensional subspace A®\b), 
for a given, fixed |6), onto a two-dimensional subspace Q of A <g> B. This mapping from A 
to A <S> B is an isometry (it preserves the inner product), and the task we face is, in essence, 
that of understanding and classifying such isometries. The classification begins by noting 
that the subspace Q can be characterized by two parameters, according to a theorem stated 
in Sec. P], which allows us to pick a basis for Q in a particularly convenient "canonical" 
form, generalizing the usual Schmidt representation for a pure state. With the help of this 
canonical basis we can express any isometry as a combination of a "canonical" isometry 
of a particularly simple structure, together with a series of one-qubit operations, that is, 
unitary transformations on A and on B. The canonical isometry can then be understood in 
geometrical terms using a Bloch sphere representation, Sec. |II|, which is also useful when 
considering the additional possibilities represented by a stochastic copying machine, Sec. [TV| . 
Both the canonical isometry and any other isometry can be easily implemented using simple 
quantum circuits, as shown in Sec. [V], to produce copying machines, including stochastic 
copying machines if one allows certain gates to be controlled by a stochastic "classical" 
signal. In the cryptographic context discussed in Sec. VI, these copying machines can serve 
as simple eavesdropping devices. A summary of our results, and an indication of some open 



problems, is presented in Sec. VTI 



II. ISOMETRIES AND TWO-DIMENSIONAL SUBSPACES 

A. Canonical basis for a two-dimensional subspace of A <8> B 

We are interested in the four- dimensional Hilbert space 

H — A®B, (2.1) 

where A and B are the two-dimensional spaces associated with the qubits a and b. Given 
an arbitrary, but fixed, initial state \b) in B for the b qubit, and a fixed unitary interaction 
U mapping Tt to itself, we define the isometry V : A — > 7i by means of the equation 

V\a) = U(\a) ® |6». (2.2) 

Thus, V tells us what happens to an arbitrary state |a) of the a qubit if we assume that \b) 
and U are fixed. The name "isometry" is appropriate, for V preserves inner products, 

(V\a)y(V\a')) = (a\V ] V\a') = (a\a'). (2.3) 

It is evident that V maps A onto some two-dimensional subspace Q of 7i. 

Using the well-known Schmidt result, an arbitrary one- dimensional subspace T of A® B 
can be characterized in the following way. Given a vector |/) of unit length in T, there are 
orthonormal bases {\a ), |ai)} and {|&o)> \bi)} of A and B such that 

\f)=fjt\a b )+ji\a 1 b 1 ), (2.4) 
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where |a &o) means |a ) ® \b ), and the phases of the basis states can always be chosen so 
that /i and Jjl are both non-negative real numbers. Note that either fi or £l, the sum of 
whose squares is one, can be thought of as giving an intrinsic "geometrical" characterization 
of the subspace J 7 , that is, one that does not depend upon the choice of bases in A and 
B, or the phase of |/). To be sure, relabeling the bases allows the interchange of \i and 
/i, so one can always restrict /i to lie between and l/y/2. It then serves as a sort of 
measure of "entanglement" of the subspace T . A three-dimensional subspace of A ® B 
can be characterized in the same way by applying the above argument to its orthogonal 
complement, since the latter is a one- dimensional space. An analogous result for a two- 
dimensional subspace is the following: 

Theorem. Let Q be a two-dimensional subspace of A ® B, where A and B are 
two-dimensional complex Hilbert spaces. Then there are orthonormal bases {|ao)> l a i)}> 
{\b ), \bi)}, and {\go), \gi)} of A, B, and Q, respectively, such that 

\g ) = i~t\a b } +/i|ai&i), 

Ifi'i) = v\a bi) + u\axb Q ), (2.5) 
with (in general complex) coefficients satisfying 

1^2 + = l = \ u \ 2 + \u\ 2 . (2.6) 

Furthermore, the bases may always be chosen in such a way that /i, p,, u, v are real and 
non- negative. 

In what follows we shall refer to the basis \\g§)-, \gi)} as the canonical basis of Q, and 
(PTBj) as the canonical representation of Q . While there ought to be a simple, elegant proof, 
we have not found one; App. [A| contains our inelegant demonstration. It makes use of the 
following result, which we shall want to refer to later: 

Lemma. Any two-dimensional subspace of the tensor product A <8> B of two two- 
dimensional complex Hilbert spaces contains at least one non-zero product vector of the 
form \g) = \a) <S> 

In fact, the "generic" two-dimensional subspace Q contains two linearly-independent, but 
not mutually orthogonal, product vectors, which play a role in our proof of the theorem, and 
have a certain geometrical significance as will be explained below in Sec. |T|. 

It is possible to represent the same subspace Q using alternative choices of the coefficients 
in ( |2.5| ), provided the corresponding bases (of A, B, and Q) are appropriately modified. The 
corresponding symmetry operations on the coefficients are discussed in App. |B|. For certain 
purposes it is convenient to choose a trigonometric representation in terms of the two angles 
( and 77: 

\g ) = cos(C/2)|a 6 ) + sin((/2)\a 1 b 1 ), 

\gx) = cos(r ] /2)\a b 1 ) + sm(r 1 /2)\a 1 bo). (2.7) 
where the factors of 1/2 are not essential, but convenient in terms of the geometry of Bloch 



sphere representations, Sec. |T|. The analysis of App. shows that one can always choose ( 
and f] to lie in the region 

0<C<^, ( + V<k. (2.8) 
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While the proof of the theorem given in App. |A| is constructive, it is not a particu- 
larly convenient way in practice to find the canonical basis. A simpler approach, which is 
satisfactory except for certain degenerate cases, is described in App. 0. 



B. Canonical form for V 



The isometry V in ( |2.2j) maps all of A onto a two-dimensional subspace Q which, by the 
theorem, possesses a canonical representation in the form ( |2.5|) . We now use this canonical 
representation to define a canonical form V c corresponding to the isometry V. Suppose that 
standard orthonormal bases {|0 a )|l a )} and {|0&)|1&)} are given for A and B. Think of them 
as defined by some convenient convention; e.g., |0) means that the spin of the spin-half 
particle is in the z direction. Relative to this basis choice we define V c : A — > A <8> B through 
the equations 

V c \0) = fi\00) + /2|11) = cos(C/2)|00) + sin(C/2)|ll), 

V c \l) = i/|01) + v\10) = cos(r?/2)|01) + sin(r//2)|10), (2.9) 

where the values of fi, etc. are the same as those in fl2.5|) and (|2.7|) , and 1 01) is short for 
|0 a l&): the a qubit label is to the left of the b qubit label. 

The isometry V is related to its canonical form through the equation 

V = (S a ® S b )V c S a , (2.10) 

where S Q and S a are one qubit unitary operations on A, and S b is a one qubit unitary 
operation on B, defined in the following way. Define the vectors 

\a* j ) = V%), (2.11) 

in A; that is, V maps |a') onto the canonical basis vector \gf) of Q. Because V is an isometry, 
{\a'o), is an orthonormal basis of A. If three one-qubit unitary operators are defined by 

SoWj) = \j a ), S a \ Ja ) = \ aj ), S b \ 3b ) = \bj), (2.12) 

for j — and 1, it is easily checked that (|2.10|) is satisfied. 

Just as the two parameters \x and v can be thought of as providing an intrinsic "geomet- 
rical" characterization of a two-dimensional subspace of A ® B, one which does not depend 
upon the the choice of bases, similarly, V c , which depends on the same two parameters, gives 
a sort of intrinsic characterization of that part of the isometry V that requires an interac- 
tion between two qubits. This is because one can think of S a and S a in (|2.10|) as unitary 
operations applied to the a qubit before and after it interacts with the b qubit, acting in 
effect as coordinate transformations, and S b as a similar unitary operation or coordinate 
transformation applied to the b qubit after it has ceased interacting with the a qubit. That 
there is no transformation on the b qubit before the interaction simply reflects the fact that 
the the initial state \b) contributes to determining the canonical form V c , as will be apparent 
when we consider specific circuits in Sec. |V[ 

A general isometry V depends, if we ignore the overall phase, on 11 real parameters: 2 
for V c and 3 for each of the one-qubit unitary transformations in (|2.10| ). Hence it is very 
helpful to be able to understand its essential features using just the two parameters which 
enter V c . We shall make use of this simplicity in discussing the Bloch sphere representation 
in Sec. |T|, and constructing quantum circuits in Sec. 0. 
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III. BLOCH SPHERE REPRESENTATION 



The Bloch sphere representation provides a convenient way of thinking about the isome- 
tries which interest us in an intuitive, geometrical way. In this language, the state of a single 
qubit is represented by a density matrix p in the form 



P 



lOo + r 



(3.1) 



where <jq is the identity operator and the Oj for j > are the usual Pauli matrices in the 
standard basis (of the a or b qubit) with columns in the order |0), |1). Or, in terms of dyads, 



0"1 

0-3 



|o)(i| + |i)(o|, 

z|l)(0|-i|0)(l|, 
|0)(0|-|1)(1|. 



(3.2) 



In (^.1[), r = (r!,r 2 ,r 3 ) is a real vector of length less than one, for a mixed state, or equal 
to one, for a pure state. For example, r = (0, 1, 0) corresponds to a spin in the y direction, 
S y = 1/2, in the usual spin-half notation, whereas r = (0, 0, 0) is the completely mixed state 
for which S y , or any other spin component, takes the values ±1/2 at random. 

If the initial state of the a qubit is represented by p m corresponding to r m , the reduced 
density matrices of the a and b qubits after the interaction giving rise to the isometry V are 



P 



Tr f 



Vp in V ] 



P 



Tr.4 \Vp in V j 



(3.3) 



corresponding to r a and r b . The vectors r a and r b are related to r m through affine trans- 
formations, 



r f = M f . r in + d f 



(3.4) 



where / stands for a or b, M f is a 3 x 3 real matrix, and a real three vector. (In 
equations of the form (|3.4| ), the vectors are column vectors, but we will generally write down 
the corresponding row vectors, as in (|3.7| ).) 

For an isometry in the canonical form V c , one has the simple expressions 



M a 



/ sin 7 
sin 5 
\ sin 7 sin 5 1 



(3.5) 



M b 



and 






cos 7 
cos 7 cos S 



(3.6) 



d a = (0,0,cos7cos<5), 
d b = (0,0, sin 7 sin 5). 



(3.7) 
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where 7 and 5 are defined by 



7 = (17 + 0A S = (i7-C)/2 (3.8) 



in terms of the angles which appear in ( |2.7| ). 

The maps (|3.4j) provide a geometrical way of describing the state evolution corresponding 



to the isometry V as it produces "copies" of the input state in the outgoing a and b qubits. In 
particular, the unit Bloch sphere of possible pure states for the a qubit before the interaction 
is mapped into ellipsoids inside the Bloch spheres of the two qubits after the interaction. 
The principal semi-axes of these ellipsoids in three orthogonal directions are given by the 
absolute values of the corresponding singular values of M a and M b } the diagonal elements 
of Q3.5|) and ( |3.6|) in the case of the canonical isometry V c , and the vectors d a and d b are the 
displacements of these ellipsoids from the centers of the corresponding Bloch spheres. The 
situation is illustrated for V c in Fig. [1]. 
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FIGURES 
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FIG. 1. The ellipsoids corresponding to the two output qubits, viewed along the x and y direc- 
tions. Here s 7 c 7 s$, and c$ are all positive and represent sin 7, cos 7, sin 5, and cos<5 respectively; 
the figures are drawn assuming that sin 7 is larger than sin 5. If some of these quantities are 
negative, the ellipsoids may be displaced in the — z direction. 



As is evident from (|3.5|) and (3J3), for each ellipsoid the length of the shortest semi-axis, 
parallel to z in the case of V c , is the product of the lengths of the other two semi-axes, 
and is also the distance the center of the other ellipsoid is displaced from the center of the 
Bloch sphere. Also, the square of the longest semi-axis for one ellipsoid plus that of the 
second-longest axis for the other ellipsoid sum up to one. These constraints ensure that each 
ellipsoid touches the corresponding Bloch sphere at two points, see Fig. [I], which represent 
pure states. These points correspond to the two linearly independent product states found 
in a two-dimensional subspace Q as discussed in App. [A[ In the special case in which 7 = 5 
(modulo 7r), the two larger semi-axes are of equal length, and the points where the ellipsoids 
touch the corresponding Bloch spheres coalesce to a single point, apart from the special case 
in which one ellipsoid is the entire Bloch sphere and the other is only a point. 

A pair of ellipsoids whose semi-axes are given by the diagonal elements in ( |3.5| ) and ( |3.6| ) 
satisfy the optimal copying conditions set forth in 0. This can be shown by denning the 
quantities 



ft = cos(5/2) cos(7/2), ft = cos(5/2) sin(7/2), 
ft = sin(<V2) cos( 7 /2), ft = sin(<5/2) sin( 7 /2), 



(3.9) 



S 



and inserting them into (4.9) and (4.17) of || to obtain the elements on the diagonal of (|3.6| ) 
as a three-vector b, and those on the diagonal of ( |3.5| ) as a three vector c. Since, in addition, 
the components of b satisfy (6.24) of @, b and c form an optimal pair in the notation of 
Sec. VI A of [Q, which means that the copying process corresponding to the isometry V c is 
optimal. 

The general isometry V is related to the corresponding canonical isometry V c through 
( P.10| ). In geometrical terms, the one qubit transformation can be thought of as rotating the 
coordinate system of the initial Bloch sphere of qubit a before the interaction takes place, 
thus changing which initial pure states are mapped to particular points on the ellipsoids for 
the outgoing qubits after the interaction. The transformation S a performs some rotation 
(real orthogonal transformation with determinant +1) on the Bloch sphere for the outgoing 
qubit a, thus rotating the corresponding ellipsoid as a rigid body, leaving its semi-axes, as 
well as its distance from the center of the Bloch sphere unchanged. Of course Sf, performs a 
similar operation on the Bloch sphere of the outgoing qubit b. 

IV. STOCHASTIC COPYING MACHINE 

Are there cases in which two copies of a single qubit can be produced by a copying machine 
using ancillary qubits (in addition to the two qubits required for the copies), but the same 
task cannot be carried out by the two-qubit copier described above? In we showed how to 
construct an optimal copying machine using three qubits (one ancillary qubit) in which the 
output ellipsoids for the two copies are centered in their respective Bloch spheres, leading 
to symmetrical copying errors. This is clearly not possible, at least in general, for a two- 
qubit copier, since the fact that the output ellipsoids are tangent to the corresponding Bloch 
spheres, see Fig. [I], means that they will be off center. However, as we shall show, it is 
possible to move these ellipsoids to the centers of their respective Bloch spheres by means of 
a stochastic two-qubit copying machine |J. While such a stochastic machine can, obviously, 
produce different results (in a statistical sense) from a simple copier, we do not know its 
limitations. 

A stochastic copying machine is one for which certain parameters entering the unitary 
transformation can be varied in a random way. For example, imagine two two-qubit copying 
machines of different construction, with the input sometimes fed to one machine and some- 
times to the other, the choice being made at random. Alternatively, a single machine may be 
equipped with a switch which can be randomly flipped between one of two different positions, 
producing two different unitary transformations inside the machine which result in different 
isometries. In either case, one can suppose that the choice between the two possibilities is 
generated by some "classical" random number generator, although a "quantum coin" could 
also be employed, as we shall see. Obviously, one could imagine using three or more ma- 
chines, or one machine with a switch which could be set at three or more positions, but for 
simplicity we shall restrict our discussion to the case where there are only two possibilities. 

For a given p m , suppose the copy machine produces an output pi in channel / = a or 
b for a switch setting of 0, and p{ for a switch setting of 1, corresponding in Bloch sphere 
language, see (|3.4|), to 

r{ = M{ ■ r™ + d{, (4.1) 
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with i = 0,1. Given that setting occurs with probability po, and 1 with probability 
Pi = 1 — p , the density matrices for the output channels will be given by 



P f = PoPo +Pip{, (4.2) 

corresponding to 

ft = M f ■ r in + d f , (4.3) 

with 

M f = p M f + Pl M{, d! = p 4 + Pl d{. (4.4) 

Of course, precisely the same formulas apply if one imagines two distinct copying machines 
rather than a single copying machine with a switch. 

As a specific example, let us suppose that the switch settings i = and 1 result in a 



canonical isometry specified by (|3~5| ) to ( |3.7| ), with 5 = 5i and 7 = 7, for setting i, and with 
the two pairs of angles related by 

7i = 7o, 5 1 = n - 5 . (4.5) 

In addition, for i — 1, but not for i = 0, a unitary transformation |0) — > |1), |1) — ► — 10), 
equivalent to R(ir) in (|5.2|) , is applied to the b output, i.e., as in (|2.10|) . Since this amounts 
to a rotation of the Bloch sphere by tt about the y axis (x — > — x, z — > —2), one can easily 
convince oneself that 

M{ = Mg, d{ = -dj. (4.6) 

Consequently, ( [4.4|) tells us that the output of this stochastic copying machine is the same 
as that of the non-stochastic machine with i = 0, except that the ellipsoid for each channel 
is displaced along the z axis in the corresponding Bloch sphere by an amount which depends 
upon p . In particular, when p = Pl = 1/2, the corresponding ellipsoids are centered. 

This result indicates that at least in certain circumstances a stochastic two-qubit copier 
can do the same job as a (more expensive) copier using additional, ancillary qubits. However, 
it is not clear that this is always the case. The construction just employed produces centered 
ellipsoids representing an optimal copying machine according to the criteria of ||, but these 
ellipsoids have a special relationship among their principal axes which does not have to hold 
for a more general copier. On the other hand, the copier described above represents only 
one among a very large number of possible stochastic machines. What stochastic copiers 
can and cannot accomplish is a problem which remains to be explored. 

It is easy to show that a stochastic machine of the form we are considering can be 
replaced by an equivalent non-stochastic or "unitary" copier employing an ancillary qubit. 
We suppose that the ancillary qubit c is initially in the state 



V^|0 c ) + ^r|l c ), (4.7) 
and that the unitary time evolution for the copier results in 
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|a)|0)|O c ) -> (U Q \a)\0))® |0 C ), 

|a)|0)|l c ) ->(tfi|a)|0))®|l c ), (4. 



where £7o and Z7i are the two unitary transformations of the two-qubit stochastic copier 
when i — and 1. One can think of |0 C ) and |l c ) as the two states of a "quantum coin", 
and using consistent history methods of the type discussed in Sec. |VI C| below it is possible 
to produce a quantum description of the copying process (|4.8| ) in which the ancillary bit 
is initially in |0 C ) with probability po and |l c ) with probability pi, so that the quantum 
coin controls the copying process in very much the same was as a classical random number 
generator. (Alternatively, one could prepare the quantum coin in the state (|4.7| ), carry out 
a measurement to determine whether it is in |0 C ) or |l c ), and use the resulting "classical" 
(macroscopic) signal to control a switch setting on the copier.) 

By generalizing this construction, using two or more ancillary qubits in the case in which 
the switch has more than two positions, it is pretty obvious that any stochastic copying 
machine can be replaced by a unitary machine employing ancillary qubits. Since stochastic 
machines with fewer qubits are likely to be easier to construct than unitary machines em- 
ploying additional ancillary qubits, one would like to know under what conditions a unitary 
copier can be replaced by a stochastic copier. At present we do not know the answer to this 
question, even in the simple case of a machine producing two copies of one qubit. 



V. QUANTUM CIRCUIT FOR ISOMETRY 

In the study of quantum computation, unitary transformations are often written as a 
series of sub-transformations corresponding to simple operations represented by quantum 
gates. Doing this helps one better understand the overall transformation, and suggests 
ways in which it might be implemented in practice. It is known [110] that any unitary 
transformation on a collection of qubits can be carried out using one-qubit gates, that is, 
unitary transformations on a single qubit, together with a particular type of two-qubit gate 
known as controlled-NOT or XOR. One qubit gates should be much easier to manufacture 
than two qubit gates, and thus there is an advantage to using as few of the latter as possible. 
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(a) 



| a) 



a 



b 



(b) 




o 



-(&> 



(c) 




H 





FIG. 2. Quantum circuits: (a) The canonical form V c , (|2.9| ). (b) The isometry V in ( p.lOj ). (c) 
Alternative circuit producing the same isometry as (a). The gates are defined in (|5.1|) to (|5,3|). 



The canonical isometry ( |2.9|) can be implemented as shown in Fig. |2|(a) using two 
controlled-NOT gates together with two one-qubit gates. The upper and lower horizon- 
tal lines in the figure correspond to the a and b qubits, thought of as moving in parallel 
through the circuit from left to right as time progresses. Initially the b qubit is in the state 
|0), whereas the a qubit is in an arbitrary state \a), and the circuit produces the transfor- 
mation ( p.9|) on the initial a qubit. The controlled-NOT gate is denoted by a vertical line 
between a controlling qubit, indicated by a solid dot, and the controlled qubit, indicated 
by a circled cross. In the first (left) controlled-NOT gate in the figure, the a qubit is the 
controlling qubit, and the unitary transformation represented by the gate on the pair \ab) is 
defined by 



|00) -> |00), |10> -> 
|01)-|01), |11)-|10), 



(5.1) 



using the same notation as in ( |2.9|) . In the second controlled-NOT gate in Fig. 0(a), b is the 
controlling qubit, so (5~T) applies with the arguments of each ket interchanged. 

The open circles in Fig. 0(a) represent one-qubit gates producing a unitary transformation 
of the form 



R(<f>)\0) = +cos(0/2)|O)+sin(0/2)|l), 
R(<f>)\l) = -sin(0/2)|O) + cos(0/2)|l). 



(5.2) 
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In Bloch sphere language this is a rotation by an angle about the y axis. The value of </> 
associated with each transformation in Fig. ^| is indicated inside the circle, and the angles 7 
and S are related through (|3.8|) to £ and rj in ( |2.9|) . The isometry V whose canonical form is 
V c can then be produced by adding to the circuit in Fig. 0(a) the additional one-qubit gates 



shown in (b), corresponding to the unitary transformations in ( |2.10| ). 

It is important to note that many different unitary transformations, and thus many 
different quantum circuits, can produce the same isometry. (In addition, the same unitary 
transformation can be produced by more than one circuit.) For example, the circuit in 
Fig. 0(c) represents a different unitary transformation from the one in (a), but produces 
precisely the same isometry on the initial a qubit. The one-qubit Hadamard gate labeled H 
corresponds to a transformation 



^|0) = (|0) + |l))/v / 2, 

iJ|l) = (|0)-|l))/v / 2. (5.3) 



As these Hadamard gates can be combined with the Sq and Sb gates when producing the 
isometry V, Fig. |](b), the circuit in (c) is effectively no more complicated than the one in 
(a). 

There are, of course, many other circuits which can produce the same isometry. In 
general such a circuit requires at least two controlled-NOT gates, for if there is only one 
controlled-NOT present, such as the circuit in Fig. 0(a) with the second two-qubit gate 
removed, the canonical form V c of the isometry, ( |2.9| ), is restricted to the case ( = rj, or 
something equivalent to this under the symmetries discussed in App. [B[ In Sec. |Vj we shall 
consider an example in which the possibility of representing the same isometry by several 
different circuits can be a useful source of physical insight. 



The stochastic copying machine described in Sec. [TV], with the two possibilities repre- 
sented by (|4.5|) together with an added R(7r) on the b output when i — 1, can be implemented 
by using the circuit of Fig. ||(b), with 5*0 and S a removed (that is, equal to the identity), 
if the unitary transformations performed by two of the one-qubit gates can be altered by 
means of a "classical" stochastic signal. For one value of the signal, Sj, is the identity, while 
for the other value, —5 is changed to 5 — it, and Sb becomes R(tt). If the signals come from 
a "classical" random number generator, this circuit will produce copies with errors of the 
type described in Sec. |TV[ 



VI. APPLICATION TO QUANTUM EAVESDROPPING 

A. Introduction 



In typical quantum cryptographic schemes (TTJ a quantum channel is used to provide 
secure communication between two users, Alice and Bob, through the fact that attempts by 
an eavesdropper Eve to obtain information by inserting a copying machine into the channel 
will produce a detectable noise, that is, a certain number of errors in the transmission from 
Alice to Bob. The problem of optimal eavesdropping is to determine how much information 
the eavesdropper can obtain for a given maximum level of noise. 
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Our purpose here is not to discuss the optimal eavesdropping problem. For the crypto- 
graphic schemes we will be concerned with, the problem has already been solved ||[7| under 
the assumption that the eavesdropper makes a separate measurement for each of the signals 
sent from Alice to Bob. Instead, we will show that the optimal eavesdropping schemes which 
have been proposed can be carried out using simpler, thus "cheaper" , quantum circuits than 
were previously known. In particular, the two qubit copying machine of the present paper 
can be used in place of the three qubit machine discussed previously in [|1^| for the BB84 [|J 
scheme, and a certain simplification of the two-qubit eavesdropping machine in @ suffices 
for the B92 HI scheme. 



B. The BB84 cryptographic scheme 



In the BB84 protocol, Alice sends Bob one qubit at a time through a quantum channel, 
using one of two basis vectors, chosen randomly, belonging to one of two orthonormal bases 
or modes, and the mode is also chosen at random. It will be convenient, in view of the 
notation employed earlier in this paper, to assume that these modes are an x mode with 
basis vectors 



|0.) = (|0> + |l»/>/2, |U = (|0)-|l))/v / 2, (6.1) 
and a y mode with basis vectors 



|0„> = (|0) + /V2, |l s > = (|0> - /V2. (6.2) 

Eve, who does not know which mode is being employed for any particular signal, sets up a 
copying machine whose action is always the same, whatever the initial qubit sent by Alice, 
and stores her copies for later measurement when Alice has publicly announced the mode 
used for each transmission. 

It was shown in || that there is an inequality giving an upper bound for the amount 
of information which Eve can gain about a signal sent in one mode for a given amount 
of noise produced in the other mode, and in [TJ] that the bound can be achieved using a 



copying circuit involving a total of three qubits (the one sent by Alice, plus two additional 
ancillary qubits provided by the copying machine). For present purposes, it is simplest to 
view the copying machine together with its input and output as constituting a quantum 
channel from Alice to Bob and, at the same time, a quantum channel from Alice to Eve, 
with the remaining qubits in each case thought of as ancillary qubits. 

As long as both of these channels are symmetrical for the modes of interest, which is to 
say the error rate is the same for sending |0) or |1), the information-theoretic bound in || is 
equivalent to the statement that if the noise or error rate for the x mode in the Alice to Eve 
channel is below a certain amount, then that for the y mode in the Alice to Bob channel 
must be above a certain amount. That is, if Eve is learning a lot about signals in the x 
mode, the copying machine will produce a lot of noise in y signals sent from Alice to Bob. 
In the Bloch sphere representation, the error rate for a channel is given by the expression 

D — 1— (a\p\a) = (1 - v in ■ r out )/2, (6.3) 
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understood in the following way. If an input signal \a), r m in the Bloch sphere representation, 
emerges from the channel described by a density matrix p corresponding to r out , and is 
measured in the +r m , —r m basis, D is the probability that this measurement yields — r m , 
an error, rather than +r m . 

If the copying machine is described by the canonical isometry V c , the error rate p x for the 
Alice to Bob (output a) channel, and q x for the Alice to Eve (output b) channel, for mode 
x, ( |6.1| ), are given by 

Pa , = (l-8in7)/2, q x = (l-cos8)/2, (6.4) 

independent of whether a \0 X ) or a \l x ) is transmitted, and for mode y by 

p v = {l-an6)/2, q y = (l-cos 7 )/2, (6.5) 

with the same error rate for \0 y ) and \l y ). The symmetry of the error rates is a consequence 
of ( |6.3|) and the fact that r m lies in the x, y place, so it is only the projection of r out in this 
plane that matters. Whereas the ellipsoids in Fig. [I] are not centered in the Bloch sphere, 
their projections on the x, y plane are centered, and this results in symmetrical error rates. 
From ( |6.4j) and ( |6.5|) it follows that 

(|-g.) a + (|-ft,) a = i/4, (6-6) 

which means that making q x small necessarily leads to p y large, approaching 1/2. In geomet- 
rical terms, enlarging the x semi-axis of the b qubit ellipsoid, Fig. [TJ, to improve the quality 
of eavesdropping in mode x necessarily results in a smaller y semi- axis for the a qubit, and 
thus more noise for mode y in the Alice-to-Bob channel. Of course, 

(|-^) 2 + (|-P,) 2 = l/4, (6.7) 

leads to the same sort of complementarity with the two modes interchanged. 

Precisely the same geometrical picture applies to the three-qubit copying machine pro- 
posed in ||, where the Bloch ellipsoids have the same sizes and shapes as those in Fig. [[J 
for corresponding choices of parameters, but are centered at the origin. It is because the x 
and y modes are employed in the cryptographic protocol, and the corresponding error rates 
remain unmodified when the ellipsoids are displaced from the origin along the z axis, that 
the two-qubit copying machine discussed in this paper yields identical results to that of the 
three-qubit copier employed earlier. Were signals also sent in the z mode, corresponding to 
|0) and |1) in the notation of ( |6.1| ) and ( |6.2| ), the outputs of the two-qubit and three-qubit 
copying machines would not be the same: in particular, the errors would not be symmetrical 
for the z mode. Thus Alice and Bob might want to make use of the z mode as well as the x 
and y modes for detecting eavesdropping. However, Eve could employ a stochastic two-qubit 
copier, as discussed in Sec. [TV], to center the ellipsoids, thus symmetrizing the z mode error, 
so that there would still be no reason for her to invest in a (presumably more expensive) 
three-qubit machine. 
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C. Semiclassical analysis of errors for BB84 



In our previous discussion of eavesdropping using a three-qubit copier, we presented 
a simple "semi-classical" perspective for understanding why increasing Eve's information 
gain for one mode necessarily increases Bob's noise for the other mode. A similar simple 
argument does not exist for two-qubit copiers (or at least we have not found one), but a 
somewhat more complicated version is possible if one exploits the possibility, mentioned 
earlier, that several different unitary transformations, and thus different quantum circuits, 
can produce the same isometry. 



Alice 



Bob 



Eve 



(a) x basis 



Alice 



Bob 



Eve 



(b) y basis 



FIG. 3. Two circuits which produce the same isometry as Fig. |2|(a). The circuit in (a) is in the 
x basis, that in (b) is in the y basis; see text. 

In particular, the two circuits shown in Fig. |3| produce the same isometry as those in 
Fig. ^(a) or (c), when the angles 7' and 5' are defined to be 



7 



tt/2 - 7, 5' = tt/2 - 5, 



(6i 



and the action of the various gates is understood in the the following way. In Fig. ^(a) the 
gates are to be thought of as in the x representation using the basis (|6.1|) . In particular, the 
controlled-NOT represents the transformation ( |5.1| ), but with and 1 replaced everywhere 
by X and l x , respectively. Likewise, the action of the one-qubit gate represented by 5 inside 
a circuit is the same as Q5.2| ) provided and 1 are replaced everywhere in ( |5.2| ) — on both 
sides — with X and 1^, and (ft is set equal to 5. Next, the two-qubit gate following the 
controlled-NOT is a "controlled-rotation" producing the transformation 
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\a)\O x )^[R{+T , )\a)]®\O x ), 

\a)\l x )^[R(-y)\a)]®\l x ), (6.9) 

where the one qubit gate R{4>) is (|5.2|) in the x representation: and 1 replaced by 0^ and 
l x . Note that the "rotation" on qubit a is carried out in opposite senses depending upon 
whether b is \0 X ) or \l x ). Also, note that the initial state of the b qubit is \0 X ), rather than 
|0), as in Fig. §. 

The circuit in Fig. 0(b) is in the y representation, which means that it is to be interpreted 
in the same way as (a), but with 0^ and l y substituted for 0^ and l x . Note that the circuits 
in Fig. produce an isometry equivalent to Fig. with the definitions for the x and y 
bases given in (|6.1|) and ( |6.2|) , but will not (at least in general) do so for other basis choices 
using different phases. For example, using |0 X ) as defined in ( |6.1| ), but replacing \l x ) with 
(|1) - 10))/^, and then using the circuit in Fig. |(a) will produce a very different result 
(try it!). 

10) 
00) 

01) 

11) 
t 3 

01> 

11) 

10) 
00) 

FIG. 4. Family of eight quantum histories for the circuit in Fig. 0(a). 

Suppose Alice sends a signal using the x mode, and Bob and Eve eventually measure 
their qubits in the same mode. Whatever two-qubit machine Eve employs (e.g., that of 
Fig. 0(a)), we can, for purposes of obtaining an intuitive picture of what is going on, imagine 
that copies are produced by the circuit shown in Fig. 0(a), as this yields the same isometry. 
This circuit can be analyzed in the same manner as that in [|12|] , using an appropriate family 
of quantum histories in which every qubit is in either the |0 X .) or the jl^) state at times when 
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it is not inside one of the gates. The different possible histories of this type are indicated 
schematically in Fig. |], where the x subscripts have been omitted. At time to the two qubits 
have not passed through any gates, and the two possible initial states, written as \ab), are 
lO^Oa;) and |1 X X ). At t\ the h qubit has passed through the 5 gate, so it can be either |0 X ) 
or 



| la); the probability of the latter is 



9* 



[sin(5/2)] 2 = |(1 -cos 5). 



(6.10) 



This probability can be computed in the standard way using weights |13| ; note that it is the 
same as what one would calculate if a measurement on this qubit were to take place at time 
t\ WM. By time t 2 the two qubits have passed thought the controlled-NOT gate, while at 



ts the a qubit has passed through the 7' gate. In passing through this gate, the a qubit is 
flipped, from \0 X ) to |1 2 ), or vice versa, with a probability 



Px = [sin(7'/2)]' 



;i - sin 7), 



(6.11) 



independent of whether the b qubit is in the state \0 X ) or |l x ), since the probability only 
depends on the magnitude, not the sign of 7'. 

The eight histories in Fig. ^ constitute a family of quantum histories which can be treated 
in the same way as a stochastic family of classical histories, as long as quantum consistency 
conditions are satisfied 
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That these conditions are, indeed, satisfied for the family under 
consideration follows from the fact that the two initial states are mutually orthogonal, and 
for each initial state, all four final states at the right side of Fig. |] are mutually orthogonal. 
Hence the corresponding chain or weight operators are orthogonal. 



Alice 



- (k 



R 



Bob 



Eve 



(a) 



Alice 



R 



Bob 



^^^} 



Eve 



(b) 

FIG. 5. Classical stochastic circuits which are equivalent to Fig. |3|(a) when using the consistent 
family of Fig. ||. 
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Consequently, the action of the circuit in Fig. ||(a) is precisely the same as that of a 
classical stochastic circuit shown in Fig. §(a), in which the gates labeled p x and q x correspond 
to randomly flipping a bit from to 1, or vice versa, with probabilities p x and q x . The effect 
of the q x gate is the same if it is placed after, rather than before, the controlled-NOT, as 
in Fig. |5|(b), which makes the action of the circuit perfectly transparent: Since the b bit is 
initially 0, the controlled-NOT copies the a bit, or 1, to the b bit. Then both bits are 
randomly flipped with appropriate probabilities before the a bit is measured by Bob and the 
b bit by Eve. 

It is evident that the eavesdropper will obtain the most information possible when q x = 0, 
while p x = yields the minimum amount of noise in the Alice-to-Bob channel. Thus, 
choosing 5 = and 7 = ir /2 represents the optimal eavesdropping strategy if the x mode 
is considered by itself. But these values create problems when Alice transmits using the y 
mode. To analyze what happens in this case, it is convenient to imagine that the actual 
copying machine, whatever it may be, is replaced by the circuit in Fig. 0(b), which produces 
the same isometry. Our preceding analysis of part (a) of that figure can be applied to (b) 
by simply replacing x with y and noting the difference in the gate parameters in the two 
cases. Thus the consistent family is that of Fig. |], where one now understands the symbols 
as having y subscripts, and the action of the quantum circuit, for the y mode, is the same 
as that of the classical circuits in Fig. |], with p x and q x replaced by 

p y = [sin(5'/2)] 2 = |(1 - sin 5), (6.12) 
g y = [sin( 7 /2)] 2 = i(l-cos 7 ). (6.13) 

Consequently, the choice 5 = 0, which provides Eve with the optimal amount of information 
about signals in the x mode, creates the maximum possible amount of noise in the Alice-to- 
Bob channel when used in the y mode. Likewise, if Eve chooses 7 = tt/2 in order to remain 
"invisible", producing no noise, when Alice is transmitting and Bob is measuring in the x 
mode, the consequence will be that she gains no information at all when Alice transmits in 
the y mode. 

Many other circuits will produce the same isometry on the a qubit as those in Fig. 0(a) 
and Fig. |||(a) and (b). For example, the two shown in Fig. |^(a) and (b) are similar to those 
shown in Fig. ^, except that the destination of the final bits has been interchanged. The 
four circuits in Figs. § and |^ represent different unitary transformations, and thus an actual 
copying machine could employ only one of these circuits. Hence it is worth emphasizing, once 
again, that all of these circuits, because they yield the same isometry, produce precisely the 
same result in terms of copies of whatever Alice sends, in the x or y or in any other mode. 
However, some circuits are more useful than others when one wants to form an intuitive 
picture of why certain parameter values lead to particular sorts of errors. 
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Alice 



-(5)— Eve 



(a) x basis 



Bob 



Alice 



IOv>^S>-0 



Eve 



Bob 



(b) y basis 

FIG. 6. A circuit (a) in the x basis and a different circuit (b) in the y basis which produce the 
same isometry as the circuits in Fig. ||(a), (c), and Fig. ||. 

D. The B92 cryptographic scheme 

In the B92 cryptographic protocol, Alice sends signals through a quantum channel in one 
of two non-orthogonal states, \kq) and |/ci), chosen at random, while Bob makes measure- 
ments in one of two orthonormal bases, also chosen at random, one of which includes \kq) 
and the other \ki). For details, see 0. Once again, eavesdropping is detected through the 
production of noise that can be detected by the legitimate users of the channel. 

Fuchs and Peres 0j carried out a numerical and analytic study of the problem of dis- 
tinguishing these two non-orthogonal states, and found an optimal strategy (under certain 
plausible assumptions) for doing this with minimal disturbance to the original signal, the 
one sent on to Bob. This strategy can be carried out using the two-qubit copying circuit in 
Fig. 0(a). Let the two non-orthogonal states used by Alice be 



I /Co) = cos a\0 x ) + sin a|lj;), 
|/ci) = sin a\0 x ) + cos a|la;), 



(6.14) 



with a (a in J7|) a parameter which determines the degree of non-orthogonality. Eve carries 
out measurements in the x basis |0 a ), jl^), and uses this information to try and determine 
whether Alice transmitted \kq) or \k\). 

The copying machine in Fig. 0(a) has two parameters 5 and 7' which are chosen by Eve 
in the following way. The value 5 = provides Eve with copies of the states (|6.14j) which 
are optimal in the sense that her measurements provide the best possible discrimination be- 
tween them; perfect discrimination is not possible, because |/c ) and \ki) are not orthogonal. 
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Choosing some other value of 5 reduces the amount of information that Eve can gain about 
the transmitted signals. For a given 5, Eve chooses 7' in such a way as to minimize the noise 
produced in the Alice-to-Bob circuit. The appropriate value is worked out in @, where the 
parameters </> and 9 are related to our 5 and 7' by 



5/2, = 772. 



(6.15) 



While the optimal 7' is a somewhat complicated function of 5, it turns out that by increasing 5 
and thereby reducing the amount of information she obtains, Eve can also reduce the amount 
of noise detectable by Alice and Bob. Thus the optimal strategy can be thought of either 
as obtaining the most information for a given level of noise, or producing the least amount 
of noise (by a suitable choice of 7') for a given amount of information (determined by the 
choice of 5). 

The consistent family of Fig. (| is inappropriate for analyzing this process because neither 
Alice nor Bob employ the |0 X ), basis. Nevertheless, because Eve measures her qubit in 
this basis, there is a consistent quantum-mechanical description in which Eve's qubit is in 
one of these two states at all times after it leaves the controlled-NOT gate in Fig. |3](a). Con- 
sequently, her measurement reveals a pre-existing value, and the measurement can equally 
well be carried out before the qubit reaches the controlled-rotation gate, as in the modified 
circuit in Fig. [?|. In this circuit the results of the measurement of |0 X ) or \l x ) are used to 
produce a "classical" signal which controls the operation of a one qubit gate that carries 
out a unitary transformation, R(+j') or R{— 7') as appropriate, on the qubit sent on to 
Bob. This use of retrodiction for simplifying a quantum circuit has been employed previ- 
ously to simplify the Fourier transform in Shor's factorization algorithm and to study 
teleportation [|1^]. Its justification lies in a correct application of consistent-history methods 
0. 



K, 







'x 




(-T) 



Bob 




Eve 



FIG. 7. Improved eavesdropping machine for the B92 protocol, in which the last gate in Fig. |||(a) 
has been replaced by two single-qubit operations determined by Eve's measurement result: R{"f') 
for |0 X ) and R(— V) f° r \^x)- Note that the gate notations and Eve's measurement are in the x 
basis, as in Fig. |3|(a). 

Since one-qubit gates, even those controlled by classical signals, are likely to be much eas- 
ier to construct than two qubit gates, the circuit in Fig. [7| represents a cost-effective approach 
to eavesdropping in the case of the B92 scheme. Unfortunately (or perhaps fortunately), it 
cannot be used for the BB84 protocol discussed earlier, because in that case Eve does not 
know ahead of time which mode Alice will employ for transmitting signals, and therefore 
has to wait until after the copying process is complete before deciding whether to carry out 
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a measurement in the x or the y basis. 



VII. SUMMARY AND OPEN QUESTIONS 

We have carried out a general analysis of a unitary transformation on two qubits from 
the point of view of a copying machine producing two copies of an arbitrary state of one of 
the input qubits while the other is held fixed. Such a transformation produces an isometry 
mapping the input qubit onto a two dimensional subspace Q of the tensor product A ® B of 
the two qubits. Central to our analysis is the theorem in Sec. [11 A| according to which there 



is a basis for Q in the canonical form given by Q2.5Q . In some sense this is an extension, 
to a particular case, of the familiar Schmidt representation for a vector on an arbitrary 
tensor product A <S> B. Using this canonical basis allows us to write an arbitrary isometry 
as a relatively simple canonical isometry, depending on two real parameters, preceded and 
followed by some additional unitary operations on individual qubits. 

A Bloch sphere representation of the output qubits, Sec. [Til], provides a geometrical 
picture which is very useful for understanding what sorts of copying errors can occur and 
the limitations on copy quality imposed by quantum theory. Despite its simplicity (or 
perhaps because of it), a two-qubit copying machine produces optimal copies according to 
the criteria worked out in [§]. By using a stochastic generalization, Sec. |TV], one can obtain 
greater flexibility in determining the types of errors which are produced by the machine. 

An isometry can be carried out using one of several possible quantum circuits constructed 
from one-qubit gates and controlled-NOT two-qubit gates, Sec. M. As two-qubit gates are 
likely to prove rather expensive, it is worth noting that two of them are sufficient, and also 
necessary for a general isometry. In addition, the canonical isometry corresponding to the 
canonical basis choice for Q requires two one-qubit gates, whereas a general isometry requires 
a total of five one-qubit gates. Some gates controlled by a "classical" stochastic signal are 
needed to implement a stochastic copying machine. 

The two-qubit copier suffices for carrying out the optimal eavesdropping strategy derived 
in || for the BB84 cryptographic scheme. The Bloch sphere picture is particularly valuable 
in showing why this simpler copier can perform as well as the three-qubit machines proposed 
in P,r3|. The stochastic two-qubit copier will also do as well as a three-qubit copier for 



certain generalizations of BB84. Physical insight into how the parameters of the two-qubit 
machine determine the information gained by the eavesdropper and the noise produced in 
the channel between the legitimate users is obtained by employing consistent families of 
quantum histories in two different circuits producing the same isometry. 

A two-qubit copier which carries out the optimal eavesdropping strategy for the B92 
cryptographic protocol proposed by Fuchs and Peres |7j] can be further simplified by replac- 
ing the second controlled-NOT gate by a one-qubit gate controlled by the classical signal 
produced by an earlier measurement. This trick for producing a more economical machine 
relies upon the justification of quantum retrodiction provided by a consistent history analysis 
as first pointed out in |15[ . 



While we have been able to characterize the most general isometry from one qubit to a 
tensor product space A ® B of two qubits, this is not the same thing as describing the most 



general unitary transformation on A (g> B, where work remains to be done [fL7] . Generalizing 
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the results of this paper to spaces A and B of dimension greater than two represents a 
challenging problem. One step towards solving it would be to find some counterpart of 
the canonical basis, Q2.5|) , when Q, A, and B are of any dimension. Another would be the 
development of some geometrical analogy of the Bloch sphere picture for higher-dimensional 
spaces. And extensions to tensor products of three or more spaces of any of our results 
would represent a significant contribution to quantum information theory. The possibilities 
and limitations of stochastic copying machines are worth exploring, given that in certain 
circumstances they appear to offer a more economical solution to copying problems than 
employing additional ancillary qubits in a quantum circuit. 
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APPENDIX A: THE CANONICAL REPRESENTATION 

Given a state \ip) of A <S> B in the form 

lv>> = E^W> ( A1 ) 

jk 

where {\a' ), \a[)} and {\b' ), 1^)} are any orthonormal bases of A and B, it is easy to show 
that a necessary and sufficient condition for \ip) to be a product state of the form \a) ® \b) 
is that 

TooTn = t 01 t w . (A2) 

The lemma that a two-dimensional subspace Q of A®B always contains a non-zero prod- 
uct state can be established as follows. Assume that l^') and are linearly independent 
vectors in Q, and is not a product state. Applying the condition ( |A2| ) to 

|V>> = \W) + W) = E(Ar; fc + ifo\a%) (A3) 

jk 

leads to a quadratic equation in A with a non-zero coefficient of A 2 , which thus has at 
least one root corresponding to a product state. (In general one expects two roots and two 
linearly-independent product states.) Consequently, there is an orthonormal basis 

l<7o) = |oo&o), \gi) = c i|a &i) + c 10 \aib ) + c u |ai&i) (A4) 

of Q written in terms of suitable orthonormal bases {!%■)} and of A and B, where \cjo) 

is the product state whose existence is guaranteed by the lemma. If en = 0, removing the 



bars in ( jA4| ) yields (|2.5|) with /i = 0, and our task is finished. 



Thus from now on we assume that 

en ± 0. (A5) 
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There is then a second product state 

= (c 01 c w /c n )\go) + \ fji), (A6) 



in Q — as can be verified using ( |A2j) — which is linearly independent of \g~o). It is convenient to 
write these two linearly-independent product states in the normalized (but not orthogonal) 
form 

{ttj) = \aj) g» |&), (A7) 

for j — 0, 1, with 

(a J \a 3 ) = l = (P j \P J ), (A8) 

and with phases chosen so that 

< (ao|ai) < 1, < (Po\Pi) < 1. (A9) 



The inequalities in ( |A9| ) are strict, since were it the case, for example that, (oto|oti) = 1, this 
would mean |ao) = and Q would consist entirely of product states of the form |«o) ® |^) ; 
which is inconsistent with (|A5|). 

Because of the strict inequality just noted, none of the four kets 

|ao) = |«o) + = |ao) - \ai), 

|So> = |/3o> + \Pi), \k) = \Po) ~ \Pi) (A10) 
is zero, and since each pair is orthogonal, 

(a o \a 1 ) = 0= <So|S x >, (All) 
one can construct orthonormal bases for A and B by appropriate normalization: 

\dj) = \a 3 )/^{a 3 \ aj ), \bj) = IbJ/y/ibjlbj). (A12) 
Inverting the relations (|A10 ) allows one to write 

|«o) = K \a ) + «|ai), = «|ao) — 

|/3 ) = A|6o) + AIM, |A) = A|6o) - A|6i), (A13) 

where the constants k, k, A, A are all strictly positive numbers. Consequently, the two or- 
thogonal vectors 

|<7o) = ko) + ki) = 2(/tA|a & ) + R\\aibi)), 

\di) = ko) - ki) = 2(AcA|a 6i) + kA|oi6o)), (A14) 
when appropriately normalized, provide an orthonormal basis for Q in the form (|2.5|). 
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APPENDIX B: SYMMETRIES OF COEFFICIENTS IN THE CANONICAL 

REPRESENTATION 



The representation ( |2.5|) is in general not unique in that the same subspace Q may possess 



an alternative orthonormal basis 

\g' ) = n'\a' b' ) +fi'\a' 1 b' 1 ), 

\g' 1 )=v'\a' b' 1 ) + v'\a' 1 b' Q ), (Bl) 

written using alternative orthonormal bases {\a' Q ), \a[)} for A and {\b' ), Ib^)} for B. Different 
sets of coefficients {//, p,', z/, v'} which can be used to represent the same subspace will be 
called equivalent, and maps which carry one set of coefficients to an equivalent set will be 
referred to as symmetry operations. (Note that replacing the coefficients in (|2.5| ) by an 
equivalent set while leaving the bases for A and B unchanged will, in general, lead to a 
different subspace Q\ the coefficient change must be accompanied by changes in the bases if 
Q is to remain unaltered.) 

It is easy to show that multiplying the coefficients by arbitrary phase factors, 

fi' = e l(t>00 fi, fi'^e^fi, i/' = e*V, v' = e^V, (B2) 

for any choice of <pjk, is a symmetry operation in the sense just defined: insert 

\af j ) = <to\a J ), |6j> = e^|6 i >, \g' 3 ) = e^%>, (B3) 

in ( |B~TD and choose the six phases ato, (*i, /3o> Pi, 7o, 7i so as to recover ( |2.5| ). (This is an 
alternative demonstration that the coefficients in (|2.5| ) can always be chosen to be real and 
positive.) 

Additional symmetries arise because it does not matter which of the special basis vectors 
in Q is called |go) and which \g\)\ likewise, one can interchange |ao) with |ai), or |6 ) with 
These interchanges give rise to three symmetry operations on the coefficients in addition to 
those in ( |B2"1) : (i) interchange [i with u, and /2 with v\ (ii) interchange fi with ft, and v with 
v\ (iii) interchange fi with v, and v with \x. Of course, (iii) is just the product of (i) and (ii). 
(Note that interchanging [i with Jx while keeping v and v fixed is not a symmetry operation.) 

When applied to the trigonometric representation ( |2.7| ), these symmetry operations allow 
one to (i) change the sign of (; (ii) change the sign of r/; (iii) increase both ( and 77 by n; (iv) 
interchange ( with rj. (Note that increasing £ by tt without changing r] is not a symmetry 
operation, although either ( or 77 can be increased by 2tt while the other remains fixed.) 
Combinations of these operations map any ((, rf) in the square 

0<C<7r, 0<77<vr, (B4) 
corresponding to positive coefficients in (|2.7p , onto the equivalent points 

(V,0, (n-C,n-v)> (n-V,n-0, (B5) 
from which it follows that (C,^) can always, if desired, be chosen to lie in the region ( |2.8|) . 
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APPENDIX C: FINDING THE CANONICAL BASIS 



The construction in App. which demonstrates the existence of the canonical represen- 
tation is not an easy way to find it. The following is an alternative approach which is simpler 
and works except for certain degenerate cases. In particular, it does not require that one 
find product states in Q. 

Given two linearly independent vectors in Q, one can construct (Gram-Schmidt) an or- 
thonormal basis {|<7o)> }, and from it the (unique) projector 

G = \g )(go\ + \gi)(g~i\ = \go)(go\ + \gi)(gi\ (Ci) 

onto the subspace Q, along with its partial traces 

G A = Tr B [G] = (u 2 + u 2 )\a )(a \ + (fx 2 + z/ 2 )|ai)(ai|, 

G B = Tx A [G] = {u 2 + v 2 )\b )(b G \ + (fi 2 + Ol&xX&xl, (C2) 

which are operators on A and B, respectively. Here we are assuming, for convenience, that 
the coefficients in fl2.5|) are real and positive. 



If the eigenvalues of Ga, in parentheses on the right side of flu2|), are non-degenerate, the 
dyads |a )(a | and |a 1 )(a 1 | are uniquely defined up to identifying which is which. We can, for 
example, assume that |a )(a | corresponds to the larger and |ai)(ai| to the smaller eigenvalue. 
A similar comment applies when the eigenvalues of Gb in (C2) are non-degenerate. The 
eigenvalues of Ga and Gb, along with the normalization condition (|2.6|) , serve to determine 
the non-negative coefficients /x, /2, u, and v. 



The dyads |cto)(ao|, etc., in ( |G2| ) determine vectors \a' ), \a[), \b' Q ), and \b[) which are 



identical to their unprimed counterparts in (|2.5| ) apart from the arbitrary phase factors in 
( |B5D . These phases cannot be chosen arbitrarily, because the relative phases of the summands 
on the right side of ( |2.5|) is significant, and the information in the partial traces (02) is not 
enough to determine them, so an additional step is needed. 

If \g) is any vector in Q (and hence a linear combination of \go) and \gi)) such that both 
(g\aobo) and {g\a\b\) are nonzero, then the positivity of the coefficients in (|2.5| ) implies that 

Ph((^|a 6o)) = PHiglaxh)), (C3) 

where the phase Ph(z) is <fi when z = \z\e % ^ . Given such a \g), which could be \g~o) or \g~i), 
the phases of the inner products (g\a' b' ) and (gla^b^), along with (|C^), constrain the choices 
of ctj and /3j in (p3|). The requirement that 

Ph«c7|ao&i» = Ph(((/| ai 6o)), (C4) 

again based on (|2.5|) , applied to a non-vanishing pair of inner products {g\a' b[) and (gla^b^), 
(with the same or a different \g) from that in ( |C3|) ) yields a second constraint for the atj and 
13 j. When both constraints are satisfied, the remaining freedom in choosing phases simply 
determines the overall phases of \go) and \gi). 
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